@pushary/agent-hooks 0.89.11 → 0.89.13

package/dist/{chunk-UDBJHQMG.js → chunk-QFJZHVVL.js}

@@ -1,6 +1,6 @@
 import {
   resolvePathBinary
-} from "./chunk-X4ZUUFKV.js";
+} from "./chunk-L4ZCFMWW.js";
 
 // src/hermes-config.ts
 import { execFileSync } from "child_process";

package/dist/chunk-QZCFVWA7.js

@@ -0,0 +1,58 @@
+import {
+  getBaseUrl
+} from "./chunk-2UMNXADU.js";
+
+// src/transcript-api.ts
+var fetchTranscriptRecipients = async (apiKey, baseUrl = getBaseUrl()) => {
+  try {
+    const res = await fetch(`${baseUrl}/api/agent/encryption-account`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: AbortSignal.timeout(5e3)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (typeof data.publicKey !== "string" || data.publicKey.length === 0) return null;
+    if (data.providerRecovery === void 0 || data.providerRecovery === null) {
+      return { phonePublicKey: data.publicKey, provider: null };
+    }
+    if (typeof data.providerRecovery !== "object") return null;
+    const provider = data.providerRecovery;
+    if (typeof provider.required !== "boolean" || typeof provider.keyId !== "string" || provider.keyId.length === 0 || typeof provider.publicKey !== "string" || provider.publicKey.length === 0) return null;
+    return {
+      phonePublicKey: data.publicKey,
+      provider: { required: provider.required, keyId: provider.keyId, publicKey: provider.publicKey }
+    };
+  } catch {
+    return null;
+  }
+};
+var fetchAccountPublicKey = async (apiKey, baseUrl = getBaseUrl()) => (await fetchTranscriptRecipients(apiKey, baseUrl))?.phonePublicKey ?? null;
+var uploadTranscriptRecords = async (apiKey, params, baseUrl = getBaseUrl()) => {
+  try {
+    const res = await fetch(`${baseUrl}/api/agent/transcript`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json" },
+      body: JSON.stringify(params),
+      signal: AbortSignal.timeout(15e3)
+    });
+    const body = await res.json().catch(() => null);
+    const keyRegistered = body?.keyRegistered === true;
+    const keyConflict = body?.keyConflict === true;
+    const ids = (value) => Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+    return {
+      ok: res.ok && !keyConflict && (params.dataEncryptionKey === void 0 || keyRegistered),
+      keyRegistered,
+      keyConflict,
+      settledIds: Array.isArray(body?.settledIds) ? ids(body.settledIds) : null,
+      rejectedIds: ids(body?.rejectedIds)
+    };
+  } catch {
+    return { ok: false, keyRegistered: false, keyConflict: false, settledIds: null, rejectedIds: [] };
+  }
+};
+
+export {
+  fetchTranscriptRecipients,
+  fetchAccountPublicKey,
+  uploadTranscriptRecords
+};

package/dist/{chunk-TY5HVMXT.js → chunk-RAEPAUNJ.js}

@@ -1,6 +1,6 @@
 import {
   getMachineId
-} from "./chunk-DKWM5T3P.js";
+} from "./chunk-JTBDBKHU.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/{chunk-NCVIWGVA.js → chunk-S4BLNILH.js}

@@ -1,6 +1,6 @@
 import {
   shouldDeferToNativeMode
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-QINYXLA5.js";
 
 // src/native-defer.ts
 var nativeDeferOptions = () => {

package/dist/{chunk-MZGWKIUZ.js → chunk-VASZ6TWW.js}

@@ -1,9 +1,9 @@
 import {
   openCodeConfigDirFrom
-} from "./chunk-34GN3IPX.js";
+} from "./chunk-ZWEKONU6.js";
 import {
   codexHomeFrom
-} from "./chunk-QA72MKIT.js";
+} from "./chunk-3YGGEDJK.js";
 
 // src/vscode-config.ts
 import { homedir } from "os";
@@ -326,6 +326,9 @@ var hasInstructionBlock = (filePath) => {
   }
 };
 
+// src/hooks-spec.ts
+var CURSOR_GATE_SCRIPT = "pushary-gate.mjs";
+
 export {
   registerPluginLocation,
   unregisterPluginLocation,
@@ -342,5 +345,6 @@ export {
   renderProjectAgentInstructions,
   writeInstructionBlock,
   removeInstructionBlock,
-  hasInstructionBlock
+  hasInstructionBlock,
+  CURSOR_GATE_SCRIPT
 };

package/dist/{chunk-SYUIXXQW.js → chunk-VF3RTVWY.js}

@@ -1,6 +1,6 @@
 import {
   quoteIfNeeded
-} from "./chunk-X4ZUUFKV.js";
+} from "./chunk-L4ZCFMWW.js";
 
 // src/hook-command.ts
 var HOOK_SHELL = "/bin/sh -c";

package/dist/{chunk-LURY4WNF.js → chunk-WHDSJ6PD.js}

@@ -1,6 +1,6 @@
 import {
   renderCommandHelp
-} from "./chunk-3XTFX4CL.js";
+} from "./chunk-GMJDQDXU.js";
 import {
   getPackageVersion
 } from "./chunk-DINDL2CF.js";

package/dist/chunk-YKLCWWEI.js

@@ -0,0 +1,76 @@
+import {
+  writeJsonAtomicDurable
+} from "./chunk-4LL6LG5X.js";
+
+// src/transcript-recipient-pin.ts
+import { existsSync, mkdirSync, readFileSync, rmSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var pinFile = () => process.env.PUSHARY_RECIPIENT_PIN_FILE?.trim() || join(homedir(), ".pushary", "recipients.json");
+var asPin = (offer) => ({
+  phonePublicKey: offer.phonePublicKey,
+  providerKeyId: offer.provider?.keyId ?? null,
+  providerPublicKey: offer.provider?.publicKey ?? null
+});
+var loadPin = () => {
+  const path = pinFile();
+  if (!existsSync(path)) return null;
+  try {
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    if (typeof raw.phonePublicKey !== "string" || raw.phonePublicKey.length === 0) return null;
+    return {
+      phonePublicKey: raw.phonePublicKey,
+      providerKeyId: typeof raw.providerKeyId === "string" ? raw.providerKeyId : null,
+      providerPublicKey: typeof raw.providerPublicKey === "string" ? raw.providerPublicKey : null
+    };
+  } catch {
+    return null;
+  }
+};
+var savePin = (pin) => {
+  const path = pinFile();
+  try {
+    mkdirSync(dirname(path), { recursive: true, mode: 448 });
+    writeJsonAtomicDurable(path, pin, 384);
+    return true;
+  } catch {
+    return false;
+  }
+};
+var clearPin = () => {
+  try {
+    rmSync(pinFile(), { force: true });
+  } catch {
+  }
+};
+var verifyRecipients = (offer, pinned) => {
+  if (!pinned) return { kind: "first-use", pin: asPin(offer) };
+  const next = asPin(offer);
+  const changed = [];
+  if (next.phonePublicKey !== pinned.phonePublicKey) changed.push("the phone key this machine seals to");
+  if (next.providerKeyId !== pinned.providerKeyId) changed.push("the compliance recovery key id");
+  if (next.providerPublicKey !== pinned.providerPublicKey) changed.push("the compliance recovery key");
+  return changed.length === 0 ? { kind: "match" } : { kind: "changed", changed };
+};
+var fingerprint = (publicKey) => {
+  const hex = Buffer.from(publicKey, "base64").toString("hex").toUpperCase();
+  return (hex.slice(0, 8).match(/.{2}/g) ?? []).join(" ");
+};
+var changedRecipientsMessage = (verdict, offer) => [
+  "[pushary] Transcript sync stopped: the keys this machine seals transcripts to have changed.",
+  ...verdict.changed.map((what) => `[pushary]   changed: ${what}`),
+  `[pushary]   now offered: phone ${fingerprint(offer.phonePublicKey)}${offer.provider ? `, recovery ${offer.provider.keyId.slice(0, 8)}` : ", no recovery key"}`,
+  "[pushary] If you reinstalled the app or rotated a key, this is expected. Compare the",
+  "[pushary] fingerprint above with the one in the app under Settings, then run:",
+  "[pushary]   pushary transcripts trust --rotate",
+  "[pushary] Until then nothing is uploaded, so no turn is sealed to a key you have not seen."
+].join("\n");
+
+export {
+  loadPin,
+  savePin,
+  clearPin,
+  verifyRecipients,
+  fingerprint,
+  changedRecipientsMessage
+};

package/dist/{chunk-253WC6O5.js → chunk-YXT55PYF.js}

@@ -1,7 +1,7 @@
 import {
   describeKeyCheck,
   keyCheckFromResponse
-} from "./chunk-BLODMQKJ.js";
+} from "./chunk-ZO43JTT3.js";
 import {
   createIo
 } from "./chunk-5RUIFDTP.js";

package/dist/{chunk-BLODMQKJ.js → chunk-ZO43JTT3.js}

@@ -12,7 +12,7 @@ import {
 } from "./chunk-2UMNXADU.js";
 import {
   isValidApiKey
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-QINYXLA5.js";
 
 // src/session.ts
 var IDENTITY_PATH = "/api/v1/server/identity";

package/dist/{chunk-OLAGKKSR.js → chunk-ZP3SNUP7.js}

@@ -1,11 +1,13 @@
 import {
   buildTranscriptRecords,
   decodePublicKey,
-  fetchAccountPublicKey,
   generateSessionKey,
-  uploadTranscriptRecords,
   wrapSessionKey
-} from "./chunk-IUN6VOKV.js";
+} from "./chunk-4IPSMEGT.js";
+import {
+  fetchTranscriptRecipients,
+  uploadTranscriptRecords
+} from "./chunk-QZCFVWA7.js";
 
 // src/live-session.ts
 var MAX_TRANSCRIPT_QUEUE = 100;
@@ -71,6 +73,8 @@ var LiveTranscriptRelay = class {
   queue = [];
   sessionKey = null;
   wrappedKey = null;
+  providerWrappedKey = null;
+  providerKeyId = null;
   keyUploaded = false;
   keyRejected = false;
   flushing = null;
@@ -97,10 +101,14 @@ var LiveTranscriptRelay = class {
   async flushBatch() {
     try {
       if (!this.sessionKey) {
-        const publicKey = await fetchAccountPublicKey(this.options.apiKey, this.options.baseUrl);
-        if (!publicKey) return false;
+        const recipients = await fetchTranscriptRecipients(this.options.apiKey, this.options.baseUrl);
+        if (!recipients) return false;
         this.sessionKey = generateSessionKey();
-        this.wrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(publicKey));
+        this.wrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(recipients.phonePublicKey));
+        if (recipients.provider) {
+          this.providerWrappedKey = wrapSessionKey(this.sessionKey, decodePublicKey(recipients.provider.publicKey));
+          this.providerKeyId = recipients.provider.keyId;
+        }
       }
       const count = Math.min(this.queue.length, 50);
       const records = buildTranscriptRecords(this.queue.slice(0, count), this.sessionKey).records;
@@ -112,6 +120,8 @@ var LiveTranscriptRelay = class {
         sessionId: this.sessionId,
         machineId: this.options.machineId,
         dataEncryptionKey: this.keyUploaded ? void 0 : this.wrappedKey ?? void 0,
+        providerWrappedSessionKey: this.keyUploaded ? void 0 : this.providerWrappedKey ?? void 0,
+        providerKeyId: this.keyUploaded ? void 0 : this.providerKeyId ?? void 0,
         records
       }, this.options.baseUrl);
       if (result.keyConflict) {

package/dist/{chunk-34GN3IPX.js → chunk-ZWEKONU6.js}

@@ -1,7 +1,7 @@
 import {
   HOOK_BUDGETS,
   OPENCODE_APPROVAL_EVENT
-} from "./chunk-X6RXX2NF.js";
+} from "./chunk-QINYXLA5.js";
 
 // src/opencode-plugin.ts
 var OPENCODE_PLUGIN_MARKER = "pushary-opencode-plugin w1";

package/dist/src/index.d.ts

@@ -151,4 +151,6 @@ declare const cancelQuestion: (apiKey: string, correlationId: string) => Promise
 declare const getApiKey: () => string;
 declare const getBaseUrl: () => string;
 
-export { askUser, cancelQuestion, fetchModeOverride, fetchModeState, getApiKey, getBaseUrl, getPolicy, handleNotification, handlePostToolUse, handlePreToolUse, handleStop, reportEvent, waitForAnswer };
+declare const fetchAccountPublicKey: (apiKey: string, baseUrl?: string) => Promise<string | null>;
+
+export { askUser, cancelQuestion, fetchAccountPublicKey, fetchModeOverride, fetchModeState, getApiKey, getBaseUrl, getPolicy, handleNotification, handlePostToolUse, handlePreToolUse, handleStop, reportEvent, waitForAnswer };

package/dist/src/index.js

@@ -1,9 +1,12 @@
 import {
   handlePreToolUse
-} from "../chunk-J4K75V4D.js";
-import "../chunk-6EKQZA6R.js";
-import "../chunk-NCVIWGVA.js";
-import "../chunk-3HFK3UXM.js";
+} from "../chunk-5MNTWAAJ.js";
+import "../chunk-B2HND22S.js";
+import {
+  fetchAccountPublicKey
+} from "../chunk-QZCFVWA7.js";
+import "../chunk-S4BLNILH.js";
+import "../chunk-FOGW6O2Y.js";
 import "../chunk-YHG74UFF.js";
 import {
   fetchModeOverride,
@@ -13,31 +16,32 @@ import {
   handlePostToolUse,
   handleStop,
   reportEvent
-} from "../chunk-FXIL7RCL.js";
+} from "../chunk-OX35BSPV.js";
 import {
   askUser,
   cancelQuestion,
   waitForAnswer
 } from "../chunk-JHJHCMAF.js";
-import "../chunk-TG3T3M4K.js";
-import "../chunk-DKWM5T3P.js";
-import "../chunk-QA72MKIT.js";
+import "../chunk-N4QJ3CLX.js";
+import "../chunk-JTBDBKHU.js";
+import "../chunk-3YGGEDJK.js";
 import "../chunk-BSZYIAZL.js";
 import "../chunk-SAF6HGAA.js";
-import "../chunk-IUWRVTQK.js";
 import "../chunk-7QLSKOSU.js";
 import "../chunk-KZERVKTD.js";
-import "../chunk-XX2V4QS5.js";
+import "../chunk-ANMHIZZY.js";
+import "../chunk-4LL6LG5X.js";
 import {
   getApiKey,
   getBaseUrl
 } from "../chunk-2UMNXADU.js";
 import {
   resolvePolicy
-} from "../chunk-X6RXX2NF.js";
+} from "../chunk-QINYXLA5.js";
 export {
   askUser,
   cancelQuestion,
+  fetchAccountPublicKey,
   fetchModeOverride,
   fetchModeState,
   getApiKey,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pushary/agent-hooks",
-  "version": "0.89.11",
+  "version": "0.89.13",
   "description": "Permission hooks for AI coding agents: route tool approvals through Pushary push notifications",
   "keywords": [
     "pushary",
@@ -51,6 +51,7 @@
     "pushary-elicitation-hook": "./dist/bin/pushary-elicitation-hook.js",
     "pushary-claude": "./dist/bin/pushary-claude.js",
     "pushary-daemon": "./dist/bin/pushary-daemon.js",
+    "pushary-daemon-supervisor": "./dist/bin/pushary-daemon-supervisor.js",
     "pushary-codex": "./dist/bin/pushary-codex.js",
     "pushary-codex-bridge": "./dist/bin/pushary-codex-bridge.js",
     "pushary-codex-hook": "./dist/bin/pushary-codex-hook.js",
@@ -71,7 +72,8 @@
     "pushary-upgrade": "./dist/bin/pushary-upgrade.js",
     "pushary-bell": "./dist/bin/pushary-bell.js",
     "pushary-bell-hook": "./dist/bin/pushary-bell-hook.js",
-    "pushary-disconnect": "./dist/bin/pushary-disconnect.js"
+    "pushary-disconnect": "./dist/bin/pushary-disconnect.js",
+    "pushary-transcripts": "./dist/bin/pushary-transcripts.js"
   },
   "files": [
     "dist",